test file (information leak) #137

[Sampaguitas]

Test file for cookie header being leaked to third party website in Open Redirects.

[FGRibreau]

this only tests that the request response is empty, not that a redirect occurred and google.com received the authorization header.

[FGRibreau]

see my comment #138 (comment)

[Sampaguitas]

Here is the test file with open redirect:

'use strict';

var request = require('../').defaults({ json: true });;
var t = require('chai').assert;

describe('Information Leak', function () {

    it('should not forward cookie headers when the request has a redirect', function (done) {

        request({
            url: 'https://httpbingo.org/redirect-to?url=http://httpbingo.org/cookies',
            headers: {
                'Content-Type': 'application/json',
                'cookie': 'ajs_anonymous_id=1234567890',
                'authorization': 'Bearer eyJhb12345abcdef'
            }
        }, function (err, response, body) {
            t.strictEqual(Object.keys(body).length, 0);
            done();
        });
    });

    it('should not forward authorization headers when the request has a redirect', function (done) {

        request({
            url: 'https://httpbingo.org/redirect-to?url=http://httpbingo.org/bearer',
            headers: {
                'Content-Type': 'application/json',
                'cookie': 'ajs_anonymous_id=1234567890',
                'authorization': 'Bearer eyJhb12345abcdef'
            }
        }, function (err, response, body) {
            t.strictEqual(body, undefined);
            done();
        });
    });

});

Without the patch /redirect-to pass the cookie to /cookies who sends it back in the body of the response.

The protocol of /cookie is different from /redirect-to so the cookie should have been removed from the header before making the request.

If the response body is an empty object "Object.keys(body).length === 0", it means that the function as successfully removed the cookie from the header before making the request so the test succeeded.

[FGRibreau]

Now I can confirm that the test works with that code :)

[Sampaguitas]

Merci d'avoir pris le temps daccepter mon pull request🙂🥳